Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Check for Unrestricted ICMP Access

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: High (not acceptable risk)
Rule ID: Network-020

Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted Internet Control Message Protocol (ICMP) access in order to protect against attackers that use brute force methods to gain access to Azure virtual machines associated with these NSGs. Internet Control Message Protocol (ICMP) is an error-reporting protocol that is typically used to troubleshoot TCP/IP networks by generating error messages for any issues with delivering IP packets. Even if ICMP is not a transport protocol, it can be used to exploit network vulnerabilities.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security

Allowing unrestricted access to your Azure virtual machines (VMs) via network security groups (NSGs) can increase opportunities for malicious activities such as denial-of-service (DoS) attacks, Smurf and Fraggle attacks.

Audit

To determine if your Azure network security groups allow unrestricted access using Internet Control Message Protocol (ICMP), perform the following actions:

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

03 From the Subscription filter box, select the Azure account subscription that you want to examine.

04 From the Type filter box, select Network security group to list only the security groups available in the selected Azure subscription.

05 Click on the name of the network security group that you want to examine.

06 In the navigation panel, under Settings, select Inbound security rules to access the list with the inbound rules defined for the selected security group.

07 On the Inbound security rules page, verify the value available in the SOURCE column for any inbound rule with the Protocol set to ICMP. If one or more rules have the SOURCE set to Any (i.e. 0.0.0.0/0), the selected network security group allows unrestricted traffic using Internet Control Message Protocol (ICMP), therefore the inbound access to the associated Microsoft Azure virtual machine(s) is not secured.

08 Repeat steps no. 5 – 7 for each network security group available in the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run network nsg list command (Windows/macOS/Linux) using custom query filters to list the names of all network security groups (and the name of their associated resource groups) available in the current Azure subscription: 

az network nsg list
    --output table
    --query '[*].{name:name, resourceGroup:resourceGroup}'

02 The command output should return a table with requested resource information: 

Name                        ResourceGroup
------------------------    ------------------------------
cc-production-server-nsg    cloud-shell-storage-westeurope
cc-staging-app-server-nsg   cloud-shell-storage-westeurope

03 Run network nsg rule list command (Windows/macOS/Linux) using the name of the Azure network security group (NSG) that you want to examine and its associated resource group as identifier parameters to describe the ICMP inbound rule defined for the selected network security group using custom query filtering: 

az network nsg rule list
  --nsg-name cc-production-server-nsg
  --resource-group cloud-shell-storage-westeurope
  --query "[?direction=='Inbound' && access=='Allow' && protocol=='ICMP']"

04 The command output should return the requested security group rule metadata or an empty array, i.e. [], if there are no rules created for using Internet Control Message Protocol (ICMP): 

[
  {
    "access": "Allow",
    "description": null,
    "destinationAddressPrefix": "*",
    "destinationAddressPrefixes": [],
    "destinationApplicationSecurityGroups": null,
    "destinationPortRange": "*",
    "destinationPortRanges": [],
    "direction": "Inbound",
    "etag": "W/\"abcdabcd-abcd-abcd-abcd-abcdabcdabcd\"",
    "id": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/networkSecurityGroups/cc-production-server-nsg/securityRules/selectedPort",
    "name": "ICMP",
    "priority": 100,
    "protocol": "ICMP",
    "provisioningState": "Succeeded",
    "resourceGroup": "cloud-shell-storage-westeurope",
    "sourceAddressPrefix": "*",
    "sourceAddressPrefixes": [],
    "sourceApplicationSecurityGroups": null,
    "sourcePortRange": "*",
    "sourcePortRanges": [],
    "type": "Microsoft.Network/networkSecurityGroups/securityRules"
  }
]

If the "sourceAddressPrefix" attribute value is set to "*", "internet" or "any", the selected network security group (NSG) allows unrestricted traffic using Internet Control Message Protocol (ICMP), therefore the ICMP inbound access to the associated Microsoft Azure virtual machine(s) is not secured.

05 Repeat step no. 3 and 4 for each Azure network security group created within the selected subscription.

06 Repeat steps no. 1 – 5 for each subscription available in your Microsoft Azure cloud account.

Remediation / Resolution

To update your Azure NSG rule(s) configuration in order to restrict ICMP access to trusted entities only, such as admin IP addresses or IP ranges, perform the following actions:

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

03 From the Subscription filter box, select the Azure account subscription that you want to access.

04 From the Type filter box, select Network security group to list only the security groups available in the selected Azure subscription.

05 Click on the name of the network security group that you want to reconfigure.

06 In the navigation panel, under Settings, select Inbound security rules to access the list with the inbound rules defined for the selected security group.

07 On the Inbound security rules page, click on the name of the non-compliant security group rule(s) that you want to reconfigure.

08 On the selected security group rule configuration panel, perform the following:

  1. Select IP Addresses from the Source dropdown list to allow inbound traffic on using Internet Control Message Protocol (ICMP) from trusted IP addresses only.
  2. For Source IP addresses/CIDR ranges, provide the source IP address, IP addresses or IP address ranges that will be allowed to access the virtual machines associated with the selected network security group (NSG). You can specify a single value or comma-separated list of multiple values. An example of multiple values is 192.168.1.5/32, 10.0.0.3/32.
  3. Make sure that Action is set to Allow and leave the rest of the NSG configuration settings unchanged.
  4. Click Save to apply the changes.

09 Repeat steps no. 5 – 8 for each network security group that allows unrestricted inbound access using Internet Control Message Protocol (ICMP), available in the selected Azure subscription.

10 Repeat steps no. 3 – 9 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run network nsg rule update command (Windows/macOS/Linux) using the name of the network security group rule that you want to reconfigure as the identifier parameter to restrict using Internet Control Message Protocol (ICMP) to trusted IP address(es) only by setting the --source-address-prefixes parameter to the IP address, IP addresses or IP address ranges that are allowed to access the virtual machines associated with the selected network security group. You can specify a single value or a space-separated list of multiple values, as shown in the example below: 

az network nsg rule update
  --name ICMP
  --nsg-name cc-production-server-nsg
  --resource-group cloud-shell-storage-westeurope
  --source-address-prefixes 192.168.10.51/32 192.168.10.52/32

02 The command output should return the metadata for the reconfigured Azure NSG rule: 

{
  "access": "Allow",
  "description": null,
  "destinationAddressPrefix": "*",
  "destinationAddressPrefixes": [],
  "destinationApplicationSecurityGroups": null,
  "destinationPortRange": "*",
  "destinationPortRanges": [],
  "direction": "Inbound",

  ...

  "name": "ICMP",
  "priority": 110,
  "protocol": "ICMP",
  "provisioningState": "Succeeded",
  "resourceGroup": "cloud-shell-storage-westeurope",
  "sourceAddressPrefix": "",
  "sourceAddressPrefixes": [
    "192.168.10.51/32",
    "192.168.10.52/32"
  ],
  "sourcePortRange": "*",
  "sourcePortRanges": [],
  "type": "Microsoft.Network/networkSecurityGroups/securityRules"
}

03 Repeat step no. 1 and 2 for each network security group (NSG) that allows unrestricted inbound access using Internet Control Message Protocol (ICMP), available in the current subscription.

04 Repeat steps no. 1 – 3 for each subscription created within your Microsoft Azure cloud account.

References

Publication date Mar 17, 2022

Related Network rules